Roam SCIM MCP integration for AI agents.
Connect AI agents to Roam SCIM through 13 structured actions, including get group, create group, delete group, and replace group. Review authentication, inpu…
- ACTION CONTRACTS
- 13
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Roam SCIM integration exposes
The Roam SCIM Agent App exposes 13 provider-backed actions for security and productivity work. Its current contract lets an authorized agent get one roam scim group by roam address id, create a roam scim group with optional initial members, and archive a roam scim group by roam address id. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Roam SCIM account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Roam SCIM capabilities.
Showing 12 of 13 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_groupREADGet one Roam SCIM group by Roam Address ID.
INPUTS: id
create_groupWRITECreate a Roam SCIM group with optional initial members.
INPUTS: displayName / memberIds
delete_groupHIGH IMPACTArchive a Roam SCIM group by Roam Address ID.
INPUTS: id
replace_groupREVIEWFully replace a Roam SCIM group display name and member list.
INPUTS: id / displayName / memberIds
create_userWRITECreate a Roam SCIM user from name, email, and optional role metadata.
INPUTS: email / givenName / familyName / externalId / active
delete_userHIGH IMPACTArchive a Roam SCIM user by Roam Person ID.
INPUTS: id
get_service_provider_configREADGet the Roam SCIM service provider configuration.
get_userREADGet one Roam SCIM user by Roam Person ID.
INPUTS: id
list_groupsREADList Roam SCIM groups with optional pagination.
INPUTS: filter / startIndex / count
list_usersREADList Roam SCIM users with optional SCIM filtering and pagination.
INPUTS: filter / startIndex / count
replace_userREVIEWFully replace supported attributes for a Roam SCIM user.
INPUTS: id / email / givenName / familyName / externalId
set_user_activeWRITEArchive or reactivate a Roam SCIM user by replacing the active flag.
INPUTS: id / active
INPUT CONTRACTS
Know what the action needs before it runs.
get_group
idREQUIRED- The Roam SCIM resource ID.
create_group
displayNameREQUIRED- The Roam SCIM group displayName value.
memberIdsOPTIONAL- Roam Person IDs to include as SCIM group members.
delete_group
idREQUIRED- The Roam SCIM resource ID.
replace_group
idREQUIRED- The Roam SCIM resource ID.
displayNameREQUIRED- The Roam SCIM group displayName value.
memberIdsOPTIONAL- Roam Person IDs to include as SCIM group members.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Group
Get one Roam SCIM group by Roam Address ID. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_groupControl Create Group
Create a Roam SCIM group with optional initial members. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_groupVerify with Get Service Provider Config
Get the Roam SCIM service provider configuration. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_service_provider_configSAFETY BOUNDARY
Operate Roam SCIM with explicit limits
- Authorize Roam SCIM with API key and grant only the provider access required by the selected actions.
- 6 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `delete_group` and `delete_user` as high-impact operations and require an explicit approval boundary.
- The sampled contract declares provider scopes including `user:write`, `user:read`, and `user:read.email`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the Roam SCIM task completed successfully.
CONNECTION MODEL
API key
Roam SCIM bearer token sent in the Authorization header. Enable SCIM in Roam Administration > Technical Setup to generate the token: https://ro.am/s/.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 5
- WRITE SIGNALS
- 4
- HIGH IMPACT
- 2
- REVIEW SIGNALS
- 2
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Roam SCIM.